nodeprotocol[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Sei blockchain platform. Analysis indicates the domain was specifically crafted to mimic legitimate Sei infrastructure, likely for credential harvesting or fraudulent token transfers. The threat type aligns with social engineering tactics, as confirmed by Google Safe Browsing's SOCIAL_ENGINEERING classification, and is consistent with observed patterns in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the domain nodeprotocol.pages.dev was registered through Cloudflare, Inc. and currently resolves to the IP address 188.114.97.3. The domain was created on March 31, 2026, an anomalous future date suggesting potential manipulation of registration records. Security vendor detections include 13/95 flags on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by multiple cryptocurrency wallet protection systems. The SSL certificate is issued by Google Trust Services, and the page title was observed as 'Suspected phishing site | Cloudflare,' indicating hosting platform detection. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Organizations should implement DNS sinkholing for 188.114.97.3 and add nodeprotocol.pages.dev to web filtering policies. Given the brand impersonation targeting Sei, security teams should monitor for similar domains using 'sei' or 'protocol' variations registered through Cloudflare. User awareness training should emphasize verification of domain authenticity before connecting wallets or entering credentials. Incident responders should preserve logs containing this domain for potential forensic analysis, particularly transactions linked to the IP 188.114.97.3 during the period of activity.